brane 0.1.1 → 0.3.1

package/dist/daemon/cert-manager.js

@@ -0,0 +1,349 @@
+// CertManager — keeps the daemon's TLS cert alive without operator action.
+//
+// The big picture: if Tailscale is running, the daemon should always be
+// serving on HTTPS with a valid cert. The operator should never have to run
+// `brane certify` to keep things working. This module owns that promise.
+//
+// Responsibilities:
+//   - On startup, ensure a valid cert exists at the canonical path,
+//     provisioning one if needed (first-run or expired).
+//   - Periodically re-check the cert and renew when it enters the renewal
+//     window (last ~30 days of a 90-day Let's Encrypt issuance).
+//   - Watch the cert file for external changes (e.g. operator ran
+//     `brane certify` by hand) and hot-reload without restart.
+//   - Surface state so the daemon can expose it on /api/status, broadcast
+//     it to the web UI, and print it in `brane daemon status`.
+//
+// What this module deliberately does NOT do:
+//   - Bind HTTPS servers (that stays in daemon/server.ts).
+//   - Broadcast over WebSockets directly (caller registers a state-change
+//     callback that does the broadcasting).
+//   - Persist state (transient, rederivable from the cert file on disk).
+import { readFileSync, watch } from "node:fs";
+import { dirname } from "node:path";
+import { provisionTlsCert, inspectCert, } from "../tls.js";
+import { getTailscaleHost } from "../tailscale.js";
+/** Renew when fewer than this many days remain on the cert. */
+const RENEW_THRESHOLD_MS = 30 * 24 * 60 * 60 * 1000;
+/** Periodic check cadence. Renewal itself is gated by the threshold. */
+const POLL_INTERVAL_MS = 60 * 60 * 1000; // 1 hour
+/** Backoff schedule after a renewal failure. Capped at the last entry. */
+const BACKOFF_SCHEDULE_MS = [
+    1 * 60 * 60 * 1000, //  1h
+    2 * 60 * 60 * 1000, //  2h
+    4 * 60 * 60 * 1000, //  4h
+    8 * 60 * 60 * 1000, //  8h
+    24 * 60 * 60 * 1000, // 24h
+];
+/** fs.watch debounce: coalesce the multiple events a single rename emits. */
+const WATCH_DEBOUNCE_MS = 200;
+/**
+ * Owns the daemon's TLS cert lifecycle. The daemon creates one instance,
+ * calls `ensureCert()` before deciding whether to bind HTTPS, registers
+ * `setSecureContext` via `onReload`, and calls `start()` once the servers
+ * are listening to begin the renewal/watch loop. `stop()` on shutdown.
+ */
+export class CertManager {
+    opts;
+    // ^ archiveDir was removed: brane has no use for prior cert pairs (no
+    // pinning clients, no offline trust state), and unbounded archival would
+    // grow ~4 entries/year forever.
+    status = {
+        state: "disabled",
+        expiresAt: null,
+        lastErrorReason: null,
+        lastErrorMessage: null,
+        nextAttemptAt: null,
+        host: null,
+    };
+    pollTimer = null;
+    watcher = null;
+    watchDebounce = null;
+    renewInflight = null;
+    consecutiveFailures = 0;
+    stopped = false;
+    constructor(opts) {
+        this.opts = {
+            certPath: opts.certPath,
+            keyPath: opts.keyPath,
+            onReload: opts.onReload,
+            onStateChange: opts.onStateChange,
+            log: opts.log ?? (() => { }),
+            resolveHost: opts.resolveHost ?? getTailscaleHost,
+            pollIntervalMs: opts.pollIntervalMs ?? POLL_INTERVAL_MS,
+        };
+    }
+    /**
+     * Synchronously look at what's on disk and (if needed/possible) provision
+     * a cert before the daemon binds. Returns true iff the daemon has a valid
+     * cert it can use to bind HTTPS. Safe to call from daemon startup — does
+     * not start the renewal loop (call `start()` after binding for that).
+     */
+    async ensureCert() {
+        const host = this.opts.resolveHost();
+        this.status.host = host ?? null;
+        const existing = inspectCert(this.opts.certPath);
+        const now = Date.now();
+        // Mirror tick()'s check: a cert whose CN doesn't match the current
+        // Tailscale host is unusable for HTTPS even if the dates are fine
+        // (tailnet rename, node rename). Without this, ensureCert would say
+        // "valid", startServer would bind HTTPS, and every client would see a
+        // TLS error until the hourly tick noticed and re-provisioned.
+        const subjectMismatch = existing && host && !subjectIs(existing.subject, host);
+        // Case A: valid cert exists for the right host. Use it; renewal loop
+        // will handle expiry later.
+        if (existing && existing.notAfter.getTime() > now && !subjectMismatch) {
+            this.status.expiresAt = existing.notAfter;
+            this.status.state = "valid";
+            this.emitStateChange();
+            return true;
+        }
+        // Case B: cert is missing/expired/wrong-subject and no Tailscale.
+        // Nothing we can do — daemon will serve HTTP only.
+        if (!host) {
+            this.status.state = "disabled";
+            this.status.expiresAt = existing?.notAfter ?? null;
+            this.emitStateChange();
+            return false;
+        }
+        // Case C: cert is missing/expired/wrong-subject and Tailscale is
+        // available. Try to provision a fresh one.
+        this.opts.log("info", subjectMismatch && existing
+            ? `TLS cert subject ${existing.subject} does not match ${host} — provisioning fresh cert`
+            : existing
+                ? `TLS cert expired ${existing.notAfter.toISOString()} — provisioning fresh cert for ${host}`
+                : `No TLS cert found — provisioning for ${host}`);
+        const ok = await this.tryProvision(host);
+        return ok;
+    }
+    /**
+     * Begin the renewal poll + fs.watch loop. Idempotent.
+     *
+     * The expected ordering at daemon startup is:
+     *   1. await mgr.ensureCert()      (provision if missing)
+     *   2. bind HTTPS server with the cert
+     *   3. mgr.start()                 (renewal + watch)
+     *   4. mgr.stop() during shutdown
+     */
+    start() {
+        if (this.pollTimer || this.stopped)
+            return;
+        this.pollTimer = setInterval(() => {
+            void this.tick();
+        }, this.opts.pollIntervalMs);
+        // Don't keep the event loop alive on the renewal timer alone.
+        this.pollTimer.unref?.();
+        this.attachWatcher();
+    }
+    /** Shut down the renewal loop and fs.watch. Idempotent. */
+    stop() {
+        this.stopped = true;
+        if (this.pollTimer) {
+            clearInterval(this.pollTimer);
+            this.pollTimer = null;
+        }
+        if (this.watchDebounce) {
+            clearTimeout(this.watchDebounce);
+            this.watchDebounce = null;
+        }
+        if (this.watcher) {
+            try {
+                this.watcher.close();
+            }
+            catch { }
+            this.watcher = null;
+        }
+    }
+    /** Current public status. Caller may serialize this to JSON. */
+    getStatus() {
+        return { ...this.status };
+    }
+    /**
+     * Force a renewal check now (skips backoff). Returns true if a renewal
+     * was attempted and succeeded. Useful for testing and for an eventual
+     * `brane certify` that just nudges the daemon instead of running the
+     * provisioning itself.
+     */
+    async renewNow() {
+        const host = this.opts.resolveHost();
+        if (!host)
+            return false;
+        return this.tryProvision(host);
+    }
+    // ----- internals -----
+    async tick() {
+        if (this.stopped)
+            return;
+        if (this.renewInflight)
+            return;
+        const host = this.opts.resolveHost();
+        if (!host) {
+            // Tailscale went away mid-life. Don't fail loudly — the daemon may
+            // still be useful over HTTP. Update host but keep current state.
+            if (this.status.host !== null) {
+                this.status.host = null;
+                this.emitStateChange();
+            }
+            return;
+        }
+        if (this.status.host !== host) {
+            // Host changed (tailnet rename, etc.) — force a renewal.
+            this.status.host = host;
+            this.opts.log("info", `Tailscale host changed to ${host} — renewing cert`);
+            await this.tryProvision(host);
+            return;
+        }
+        // Respect backoff: if a previous attempt failed and the cooldown
+        // hasn't passed, do nothing this tick.
+        if (this.status.nextAttemptAt && this.status.nextAttemptAt.getTime() > Date.now()) {
+            return;
+        }
+        const current = inspectCert(this.opts.certPath);
+        const now = Date.now();
+        const expiresAt = current?.notAfter ?? null;
+        const expiresSoon = !current || current.notAfter.getTime() - now < RENEW_THRESHOLD_MS;
+        const subjectMismatch = current && this.status.host && !subjectIs(current.subject, this.status.host);
+        if (!expiresSoon && !subjectMismatch) {
+            // Steady state — nothing to do. Make sure status reflects reality.
+            if (this.status.state !== "valid" || this.status.expiresAt?.getTime() !== expiresAt?.getTime()) {
+                this.status.state = "valid";
+                this.status.expiresAt = expiresAt;
+                this.status.lastErrorReason = null;
+                this.status.lastErrorMessage = null;
+                this.status.nextAttemptAt = null;
+                this.emitStateChange();
+            }
+            return;
+        }
+        await this.tryProvision(host);
+    }
+    async tryProvision(host) {
+        if (this.renewInflight) {
+            await this.renewInflight;
+            return this.status.state === "valid";
+        }
+        this.status.state = "renewing";
+        this.emitStateChange();
+        let resolveInflight;
+        this.renewInflight = new Promise((r) => { resolveInflight = r; });
+        try {
+            this.opts.log("info", `Provisioning TLS certificate for ${host}...`);
+            const result = await provisionTlsCert({
+                host,
+                certPath: this.opts.certPath,
+                keyPath: this.opts.keyPath,
+            });
+            if (result.ok) {
+                this.consecutiveFailures = 0;
+                this.status.state = "valid";
+                this.status.expiresAt = result.notAfter;
+                this.status.lastErrorReason = null;
+                this.status.lastErrorMessage = null;
+                this.status.nextAttemptAt = null;
+                this.opts.log("info", `  Certificate written to ${result.certPath}`);
+                this.opts.log("info", `  Key written to ${result.keyPath}`);
+                this.opts.log("info", `  Expires: ${result.notAfter.toISOString()}`);
+                this.reloadFromDisk();
+                this.emitStateChange();
+                return true;
+            }
+            // Failure path: record state, schedule next attempt.
+            this.consecutiveFailures++;
+            const backoffMs = BACKOFF_SCHEDULE_MS[Math.min(this.consecutiveFailures - 1, BACKOFF_SCHEDULE_MS.length - 1)];
+            this.status.state = "failed";
+            this.status.lastErrorReason = result.reason;
+            this.status.lastErrorMessage = result.message;
+            this.status.nextAttemptAt = new Date(Date.now() + backoffMs);
+            // Don't clobber expiresAt — the old cert may still be live & valid.
+            const existing = inspectCert(this.opts.certPath);
+            this.status.expiresAt = existing?.notAfter ?? null;
+            this.opts.log("warn", `TLS provisioning failed (${result.reason}): ${result.message}. Next attempt at ${this.status.nextAttemptAt.toISOString()}`);
+            if (result.stderr) {
+                for (const line of result.stderr.split(/\r?\n/).filter(Boolean)) {
+                    this.opts.log("warn", `  ${line}`);
+                }
+            }
+            if (result.reason === "https_not_enabled") {
+                this.opts.log("warn", "Enable HTTPS for your tailnet at https://login.tailscale.com/admin/dns");
+            }
+            this.emitStateChange();
+            return false;
+        }
+        finally {
+            resolveInflight();
+            this.renewInflight = null;
+        }
+    }
+    attachWatcher() {
+        if (this.watcher)
+            return;
+        // Watch the directory rather than the file — atomic rename removes the
+        // original inode, which detaches a file-level watcher on most platforms.
+        try {
+            this.watcher = watch(dirname(this.opts.certPath), (_event, filename) => {
+                if (filename !== "tls.crt" && filename !== "tls.key")
+                    return;
+                if (this.watchDebounce)
+                    clearTimeout(this.watchDebounce);
+                const t = setTimeout(() => {
+                    this.watchDebounce = null;
+                    this.handleExternalChange();
+                }, WATCH_DEBOUNCE_MS);
+                // Don't keep the event loop alive on a pending debounce.
+                // Without this, node:test's worker process on Linux never exits
+                // after the tests pass: the fs.watch callback fires once during
+                // mgr.stop()'s teardown, creates a new setTimeout, and the
+                // process hangs waiting for it.
+                t.unref?.();
+                this.watchDebounce = t;
+            });
+            // Same reason — the inotify handle on Linux keeps the event loop
+            // alive even after we've called .close() (close drains async).
+            // Unref so the test process can exit cleanly.
+            this.watcher.unref?.();
+        }
+        catch (err) {
+            this.opts.log("warn", `Failed to attach cert watcher: ${err.message}`);
+        }
+    }
+    handleExternalChange() {
+        if (this.stopped)
+            return;
+        const inspected = inspectCert(this.opts.certPath);
+        if (!inspected)
+            return;
+        const sameExpiry = this.status.expiresAt &&
+            inspected.notAfter.getTime() === this.status.expiresAt.getTime();
+        if (sameExpiry)
+            return; // no actual change
+        this.status.state = "valid";
+        this.status.expiresAt = inspected.notAfter;
+        this.status.lastErrorReason = null;
+        this.status.lastErrorMessage = null;
+        this.status.nextAttemptAt = null;
+        this.consecutiveFailures = 0;
+        this.opts.log("info", `TLS cert reloaded from disk (expires ${inspected.notAfter.toISOString()})`);
+        this.reloadFromDisk();
+        this.emitStateChange();
+    }
+    reloadFromDisk() {
+        try {
+            const cert = readFileSync(this.opts.certPath);
+            const key = readFileSync(this.opts.keyPath);
+            this.opts.onReload(cert, key);
+        }
+        catch (err) {
+            this.opts.log("error", `Failed to hot-reload cert: ${err.message}`);
+        }
+    }
+    emitStateChange() {
+        this.opts.onStateChange?.(this.getStatus());
+    }
+}
+function subjectIs(subject, host) {
+    const cnLine = subject.split(/\r?\n/).find((l) => l.startsWith("CN="));
+    if (!cnLine)
+        return false;
+    return cnLine.slice(3).trim().toLowerCase() === host.toLowerCase();
+}
+//# sourceMappingURL=cert-manager.js.map

package/dist/daemon/client.js

@@ -0,0 +1,262 @@
+import { openDatabase, getPackageVersion } from "../db/schema.js";
+import { request as httpRequest } from "node:http";
+import { existsSync } from "node:fs";
+import { getTailscaleHost } from "../tailscale.js";
+import { ensureDaemonRunning } from "../commands/daemon.js";
+/** Pick the origin a *local* client should use to reach the daemon.
+ *
+ *  Without TLS this is just loopback on the primary port. With TLS it can't
+ *  be: the cert is issued for the Tailscale hostname and is never valid for
+ *  `127.0.0.1`, so loopback has to go through the daemon's plain-HTTP
+ *  fallback listener (private IPs only, hence safe). The Tailscale hostname
+ *  is the last resort for the narrow window where TLS is up but the fallback
+ *  port hasn't been recorded yet. */
+export function buildDaemonBaseUrl(addr) {
+    if (!addr.tls)
+        return `http://127.0.0.1:${addr.port}`;
+    if (addr.httpPort)
+        return `http://127.0.0.1:${addr.httpPort}`;
+    if (addr.tailscaleHost)
+        return `https://${addr.tailscaleHost}:${addr.port}`;
+    throw new Error("Daemon is running with TLS but has no HTTP fallback port recorded, and " +
+        "no Tailscale hostname was found to validate its certificate against.");
+}
+/** Read the daemon's address out of the meta table. `opts.tailscaleHost`
+ *  injects the hostname instead of shelling out to `tailscale status` — used
+ *  by tests to keep this deterministic; when the key is present (even as
+ *  `undefined`) the live lookup is skipped. */
+export function readDaemonAddress(db, port, opts = {}) {
+    const metaValue = (key) => db.prepare("SELECT value FROM meta WHERE key = ?").get(key)?.value;
+    const tls = metaValue("daemon_tls") === "true";
+    const tailscaleHost = "tailscaleHost" in opts ? opts.tailscaleHost : getTailscaleHost();
+    return {
+        port,
+        tls,
+        httpPort: tls ? metaValue("daemon_http_port") : undefined,
+        tailscaleHost: tls ? tailscaleHost : undefined,
+    };
+}
+/** What this process presents to the daemon. Inside an agent's session the
+ *  CLI and MCP bridge act as that agent, with the token its launch minted
+ *  for it, so what they do is attributed to, and revocable with, that
+ *  narrative. Anywhere else it is nothing (null): this machine holds no
+ *  token, and a request with none acts as this Unix account when it arrives
+ *  over the daemon's socket, the one place only this account can reach. No
+ *  file is read: `.daemon_token`, where older branes kept a local token, is
+ *  retired (`bootstrapTokens`, src/db/tokens.ts). */
+export function resolveCredential(env = process.env) {
+    return env.BRANE_NARRATIVE_SECRET || null;
+}
+/** Resolve a reachable daemon, starting one if none is running.
+ *
+ *  `ensureDaemonRunning` returns as soon as the primary port is recorded, but
+ *  the HTTP fallback port lands a beat later — so on a TLS daemon we give that
+ *  row a moment to appear before falling back to the Tailscale hostname. */
+export async function resolveDaemonEndpoint() {
+    const address = await ensureDaemonRunning();
+    for (let attempt = 0;; attempt++) {
+        const db = openDatabase();
+        let addr;
+        let token;
+        let socketPath;
+        try {
+            addr = readDaemonAddress(db, address.port);
+            token = resolveCredential();
+            socketPath = readDaemonSocket(db);
+        }
+        finally {
+            db.close();
+        }
+        if (addr.tls && !addr.httpPort && attempt < 10) {
+            await new Promise((r) => setTimeout(r, 100));
+            continue;
+        }
+        return {
+            baseUrl: buildDaemonBaseUrl(addr),
+            token,
+            port: address.port,
+            version: address.version,
+            ...(socketPath ? { socketPath } : {}),
+        };
+    }
+}
+/** The socket a running daemon advertised, if its file is there. */
+export function readDaemonSocket(db) {
+    const row = db.prepare("SELECT value FROM meta WHERE key = 'daemon_socket'").get();
+    return row && existsSync(row.value) ? row.value : undefined;
+}
+/** Send one request to the daemon: over its Unix socket when it has one,
+ *  else (or when the socket cannot be connected to, so nothing was sent)
+ *  over TCP to `baseUrl`. */
+export async function sendToDaemon(endpoint, path, init) {
+    if (endpoint.socketPath) {
+        const viaSocket = await new Promise((resolve, reject) => {
+            const req = httpRequest({ socketPath: endpoint.socketPath, path, method: init.method, headers: init.headers }, (res) => {
+                const status = res.statusCode ?? 0;
+                let consumed = false;
+                resolve({
+                    ok: status >= 200 && status < 300,
+                    status,
+                    body: res,
+                    async text() {
+                        if (consumed)
+                            return "";
+                        consumed = true;
+                        let out = "";
+                        res.setEncoding("utf8");
+                        for await (const chunk of res)
+                            out += chunk;
+                        return out;
+                    },
+                });
+            });
+            // Until the socket connects, nothing of this request has been sent, so
+            // any failure (gone, refused, no permission, not a socket) is safe to
+            // retry over TCP. After it, the daemon may have acted: report it.
+            let connected = false;
+            req.on("socket", (sock) => {
+                if (!sock.connecting)
+                    connected = true;
+                else
+                    sock.once("connect", () => { connected = true; });
+            });
+            req.on("error", (err) => {
+                if (!connected)
+                    resolve(null);
+                else
+                    reject(err);
+            });
+            if (init.body !== undefined)
+                req.write(init.body);
+            req.end();
+        });
+        if (viaSocket)
+            return viaSocket;
+    }
+    // Without a token, TCP would only answer 401: say what actually failed.
+    if (endpoint.token === null) {
+        throw new Error(endpoint.socketPath
+            ? `could not connect to the daemon's socket (${endpoint.socketPath}); \`brane daemon restart\` puts it back`
+            : "the daemon is running without its socket (daemon.sock), which is the only way this shell reaches it; " +
+                "`brane daemon logs` says why it could not listen there, and `brane doctor` checks it");
+    }
+    const res = await fetch(`${endpoint.baseUrl}${path}`, init);
+    return {
+        ok: res.ok,
+        status: res.status,
+        text: () => res.text(),
+        body: res.body,
+    };
+}
+/** What a 401 means for a request that presented no token over the socket. */
+const TOKENLESS_REFUSED = "the daemon would not let a request without a token act as this account; " +
+    "it does so only while ~/.brane is owned by you and closed to group and other (chmod 700 ~/.brane), " +
+    "and `brane daemon logs` says why it refused";
+function authorization(endpoint) {
+    return endpoint.token === null ? {} : { Authorization: `Bearer ${endpoint.token}` };
+}
+/** Warn when the daemon we're delegating to was built from different sources
+ *  than this CLI. It matters more for delegated work than for read-only
+ *  status: a request field this CLI knows about (say `extra_args`) is simply
+ *  ignored by an older daemon, with no error to notice. */
+export function warnIfVersionMismatch(endpoint) {
+    const myVersion = getPackageVersion();
+    if (endpoint.version && endpoint.version !== myVersion) {
+        process.stderr.write(`Warning: daemon is v${endpoint.version}, this CLI is v${myVersion}. ` +
+            `Run \`brane daemon restart\` to pick up this build.\n`);
+    }
+}
+/** Call a daemon JSON API endpoint. Throws with the daemon's own `error`
+ *  string when it reports one, so CLI output matches what the web app shows. */
+export async function daemonRequest(endpoint, path, init = {}) {
+    const res = await sendToDaemon(endpoint, path, {
+        method: init.method ?? "GET",
+        headers: {
+            ...authorization(endpoint),
+            ...(init.body !== undefined ? { "Content-Type": "application/json" } : {}),
+        },
+        ...(init.body !== undefined ? { body: JSON.stringify(init.body) } : {}),
+    });
+    const text = await res.text();
+    let data;
+    try {
+        data = text ? JSON.parse(text) : {};
+    }
+    catch {
+        data = {};
+    }
+    if (!res.ok) {
+        const message = data && typeof data === "object" && typeof data.error === "string"
+            ? data.error
+            : `${init.method ?? "GET"} ${path} failed (${res.status})`;
+        // Inside an agent's session the CLI presented that agent's token; a 401
+        // then almost always means it was revoked or superseded by a revive.
+        if (res.status === 401 && process.env.BRANE_NARRATIVE_SECRET && endpoint.token === process.env.BRANE_NARRATIVE_SECRET) {
+            throw new Error(`${message}: this session's agent token (BRANE_NARRATIVE_SECRET) was refused, ` +
+                "probably revoked; the operator can revive the session");
+        }
+        if (res.status === 401 && endpoint.token === null)
+            throw new Error(`${message}: ${TOKENLESS_REFUSED}`);
+        throw new Error(message);
+    }
+    return data;
+}
+/** Call a daemon endpoint that answers with newline-delimited JSON, handing
+ *  each line to `onLine` as it arrives — for work that reports progress
+ *  (`POST /api/absorb`). A non-2xx status is an ordinary JSON error and is
+ *  thrown the way `daemonRequest` throws it; the stream itself is only ever
+ *  opened once the daemon has accepted the request. Resolves when the daemon
+ *  ends the response. A partial trailing line (the connection dropped
+ *  mid-record) is discarded rather than parsed. */
+export async function daemonStream(endpoint, path, init, onLine) {
+    const res = await sendToDaemon(endpoint, path, {
+        method: init.method ?? "POST",
+        headers: {
+            ...authorization(endpoint),
+            Accept: "application/x-ndjson",
+            ...(init.body !== undefined ? { "Content-Type": "application/json" } : {}),
+        },
+        ...(init.body !== undefined ? { body: JSON.stringify(init.body) } : {}),
+    });
+    if (!res.ok) {
+        const text = await res.text();
+        let message = `${init.method ?? "POST"} ${path} failed (${res.status})`;
+        try {
+            const data = JSON.parse(text);
+            if (typeof data.error === "string")
+                message = data.error;
+        }
+        catch {
+            // not JSON; keep the status line
+        }
+        if (res.status === 401 && endpoint.token === null)
+            message = `${message}: ${TOKENLESS_REFUSED}`;
+        throw new Error(message);
+    }
+    if (!res.body)
+        return;
+    const decoder = new TextDecoder();
+    let buffered = "";
+    for await (const chunk of res.body) {
+        buffered += decoder.decode(chunk, { stream: true });
+        let nl;
+        while ((nl = buffered.indexOf("\n")) !== -1) {
+            const line = buffered.slice(0, nl).trim();
+            buffered = buffered.slice(nl + 1);
+            if (line)
+                onLine(JSON.parse(line));
+        }
+    }
+    // The daemon terminates every record with a newline, so a non-empty
+    // remainder is a record the connection cut short.
+    const tail = (buffered + decoder.decode()).trim();
+    if (tail) {
+        try {
+            onLine(JSON.parse(tail));
+        }
+        catch {
+            // partial trailing record; discard
+        }
+    }
+}
+//# sourceMappingURL=client.js.map